Firewalls and cybersecurity across San Bernardino County. Locally owned and operated, with local support. Call or text (760) 684-4139Sign inRequest service or a quote
WENO Office Solutions

Home > Cyber insurance readiness > Insurance questionnaire

CYBER INSURANCE APPLICATIONS
A "yes" you cannot back up can cost you the claim.

Cyber insurance questionnaire help: answer honestly, get covered

Your agent sent a security questionnaire with your new policy or renewal. The questions are technical, the answers matter, and checking "yes" on something you do not actually have can give the insurer a reason to deny a claim later. Here is what the common questions mean and what to put in place first.

Help me with my questionnaireCall or text (760) 684-4139
✓ New policies and renewals★ We explain each question in plain English

The short answer

  • Insurers now ask about specific security controls before they will cover you or renew you.
  • The big ones are multi factor sign in (MFA), endpoint detection and response (EDR), backups kept offline or immutable, staff phishing training, patching and limiting admin accounts.
  • Your answers become part of the policy. If they are wrong, the insurer may reduce or deny a claim.
  • Missing controls usually mean a higher premium, lower limits or a declined application.
  • We check what you really have, put the missing pieces in place and help you answer accurately.
MFAthe most asked question
EDRon every computer
Offlineor immutable backups
Yearlystaff training

The questions you will see, explained

QuestionWhat it really means
Do you require MFA for email?Every mailbox needs a second step, like an app code, to sign in. Including the owner's.
MFA for remote access?Any way into your network from outside (VPN, remote desktop, remote support tools) needs MFA.
MFA for admin accounts?Accounts that can change settings need MFA and should not be used for daily work.
Do you use EDR?Security software that watches for attacker behavior, not just old style antivirus.
Are backups offline, segmented or immutable?Ransomware cannot reach or delete at least one copy. And you have tested restoring it.
Do you train employees on phishing?Training at least yearly, ideally with practice phishing emails.
Do you patch critical updates within a set time?Computers, firewalls and servers get security updates promptly, often within 30 days or faster for critical flaws.
Do you verify payment changes by phone?Any change to wiring or bank details is confirmed with a call to a known number.
Do you have an incident response plan?A written plan for who to call and what to do in the first hours of an attack.

Fix these first

🔑MFA everywhereEmail, remote access and admin. Fast to set up and asked by nearly every insurer.
🛡EDR on every deviceManaged endpoint protection on all computers and servers.
💾Backups ransomware cannot touchAn offline or immutable copy, tested.
🎓TrainingShort phishing training for everyone, with records. See phishing training.

Answering honestly

  • If a control is partly in place, say so. "MFA on email for all users, not yet on the old file server" is better than a blanket yes.
  • If you are putting something in place, give the date. Many insurers accept a plan with dates.
  • Keep a copy of the completed application and proof of each control.
  • Recheck the answers at every renewal. Staff, computers and software change.

How WENO helps with your questionnaire

1. Read it with youWe go through each question and tell you what it means for your office.
2. Check what you haveEmail, computers, firewall, backups and remote access, checked for real.
3. Close the gapsMFA, EDR, backups, a WatchGuard® firewall, patching and training.
4. Proof fileScreenshots and reports that show each control is in place, ready for your agent or insurer.
5. Renewal readyWe update the file before each renewal so the next questionnaire is quick.

Questions people ask

Can you fill out the application for us?

You sign the application, so the answers are yours. We give you the accurate technical answers and the proof behind them.

Is regular antivirus enough?

Usually not. Most insurers now ask for EDR, which watches for attacker behavior and can isolate a computer.

We use Microsoft 365. Is MFA already on?

Not always. Many tenants have gaps, such as older accounts or shared mailboxes without it. We check every account.

Will this lower our premium?

It often helps with pricing and limits, and it keeps you insurable. The insurer sets the final price.

Cyber insurance readinessHIPAA risk assessmentPhishing trainingReal estate and escrow wire fraudWatchGuard firewallsBuy, lease or hardware as a service
Answer every question with proof.We check, fix and document the controls insurers ask about.
Help me with my questionnaire

Sources

  1. CISA: Secure Our World
  2. FTC: Cyber insurance for small business

General information, not legal or insurance advice. Your agent and policy set the actual terms.